A computer network generally includes a number of interconnected network devices. Large networks, such as the Internet, typically include a number of interconnected computer networks, which in this context are often referred to as sub-networks or subnets. These subnets are each assigned a range of network addresses that can be allocated to the individual network devices that reside in the respective subnet. A server in each subnet may be responsible for allocating these network addresses in accordance with a network address allocation protocol, such as a dynamic host configuration protocol (DHCP).
Service provider networks typically assign private network addresses to the subscriber equipment (e.g., cable modems, DLS modems, mobile devices) utilized by their customers. For example, a DHCP server or Radius server may dynamically assign a private address to a subscriber equipment upon establishing a network connection for the subscriber equipment. When not in use, the network connection is torn down and the private address is returned to a pool of provider addresses utilized within the service provider network. These private addresses are not routable outside the service provider network. Instead, a network address translation (NAT) device translates the private addresses currently used by each subscriber equipment to public network addresses that are routable within a public network, such as the Internet.
Service providers are often required to be able to identify a particular customer that is associated with particular network traffic. For example, service provides are typically required to maintain information such that any give network address that sourced or received certain traffic can be traced back to the particular customer. As a result, service providers typically maintain archives of NAT system log files (“syslog”). Each syslog file stores potentially a significant amount of information including the private source IP address, the private source port, any VPN information of the subscriber, tunneling information, any NAT rules/terms, public IP address and port assigned to the subscriber, and the like.
The service providers are typically required to store this information for months or years to meet law enforcement requirements. This can present significant challenges and burdens in certain environments, such as large service provider networks where session setup rate is typically very high with tens of thousands of sessions being established and torn down each day. Generating syslogs with NAT translation information in such an environment, referred to as Carrier Grade NAT (CGN), for each and every session during the setup and teardown consumes resources on the NAT device, network bandwidth and also resources on the servers storing the syslogs.